thum[.]ioDomain
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
LogoKit Phishing Kit Screenshots Victim Sites in Real Time“Barracuda found the kit using Thum[.]io, a commercial screenshot service, to capture the victim's real website for the phishing background, and Clearbit to supply the matching brand logo.”
-
The DocuSign Impersonation Wave with Real-Time Customizable LogoKit“Using the domain value passed through the URL, the page fetches a background screenshot of the target website via the thum[.]io service and retrieves the favicon using Clearbit or Google’s favicon service.”
Indicators reported together
named in the same reports- 107.174.142[.]90in 1 report
- 198.23.160[.]148in 1 report
- 172.245.25[.]171in 1 report
- 213.210.58[.]119in 1 report
- 80.97.160[.]191in 1 report
- 213.209.157[.]59in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.